SMB NTLM Relay – Hash Relay to Shell
NTLM relay intercepts an authentication attempt from one host and forwards it to another before the original connection completes. The target validates the relayed credential as legitimate. You never need to know the password — you just need to be in a position to receive authentication and a target that does not require SMB signing.
The prerequisite is a way to trigger authentication to your listener: LLMNR/NBT-NS poisoning with Responder, authentication coercion via SpoolSample or PetitPotam, or a writeable share trick that forces a UNC path lookup. The other prerequisite is at least one target with SMB signing disabled or not required — that is still common across workstations in most AD environments.
Finding Relay Targets
Generate a target list of hosts with SMB signing disabled or not required:
Any host in targets.txt is a valid relay target. Domain Controllers have signing required by default — do not waste time relaying to them unless you have a specific cross-protocol plan.
Setting Up ntlmrelayx
Turn off Responder's SMB and HTTP servers first so they do not conflict with ntlmrelayx:
Warning
This may be restricted in exams such as OSCP. Responder poisoning and spoofing is explicitly not allowed on the OSCP exam. Verify exam rules before use.
Start Responder for poisoning only:
Start ntlmrelayx targeting your list:
When a relay succeeds and the relayed user has local admin on the target, ntlmrelayx dumps the SAM database by default.
Getting a Shell Directly
Use -c to execute a command instead of dumping SAM. Drop a reverse shell:
Or use -i for an interactive SMB shell on the first successful relay:
When a relay succeeds, ntlmrelayx opens a local TCP port. Connect to it with nc:
This gives you an interactive SMB shell as the relayed user.
SOCKS Proxy Mode for Reusable Sessions
With -socks, ntlmrelayx keeps relay sessions alive and exposes them as a SOCKS proxy. This lets you reuse the authenticated session with any tool:
Once a relay succeeds, sessions appear in the ntlmrelayx prompt:
ntlmrelayx> socks
Protocol Target Username Port
-------- -------------- -------------------- ----
SMB 10.10.10.15 CORP/jsmith 445
SMB 10.10.10.22 CORP/administrator 445
Use proxychains to route any Impacket tool through the session:
Relay Without Responder – Authentication Coercion
If Responder poisoning is restricted or not available, trigger authentication directly using coercion tools. These force the target to authenticate to your ntlmrelayx listener:
Or with Coercer:
Warning
This may be restricted in exams such as OSCP. Verify exam rules before use.
The coerced machine account authentication relays to your target list. Machine accounts often have local admin on other hosts in the same OU or via GPO, making this reliable.
Cross-Protocol Relay to LDAP
If all SMB targets have signing required, relay to LDAP instead. LDAP signing is not enforced by default on many DCs. With a relayed DA or machine account:
This grants DCSync rights to a user you control. Then run DCSync to dump the domain:
For the full LDAP relay workflow, see LDAP Relay and Signing Abuse. For post-DCSync paths, see Active Directory DCSync and Domain Takeover.
Non-Admin Relay
Even without local admin on the target, a successful relay is still useful. A non-admin relay gives you authenticated SMB read access to the target's shares as the relayed user. Use the SOCKS mode and browse shares:
Browse for sensitive files, credentials, scripts, or config files in accessible shares.
For AD-specific relay chains (LDAP, ADCS, DCSync), see AD NTLM Relay.
References
-
Fortra ntlmrelayx.py source and full option reference.
-
Laurent Gaffie Poisoning tool used to capture and forward authentication to ntlmrelayx.
Was this helpful?
Your feedback helps improve this page.